CVE-2019-11294mediumCWE-200

CVE-2019-11294: falha de média gravidade em Cloud Foundry CAPI

CAPI leaks service broker URLs and GUIDs to space developers

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar CAPI

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.8%
Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Cloud Foundry · CAPI
CVEs relacionadas — Cloud Foundry CAPI

No mesmo produto, das mais perigosas para as menos.

CVE-2019-3785MEDIUMCloud Controller provides signed URL with write authorization to read only userEPSS 1.3%CVE-2020-5423HIGHCloud Controller is vulnerable to denial of service via YAML parsingEPSS 1.1%CVE-2020-5417HIGHCloud Controller may allow developers to claim sensitive routesEPSS 1.0%CVE-2020-5400HIGHCloud Controller logs environment variables from app manifestsEPSS 0.8%CVE-2020-5418LOWCloud Controller allows users with no roles to list dropletsEPSS 0.6%